OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco ACI must automatically audit account creation.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-271939CACI-ND-000024SV-271939r1114173_ruleCCI-000018medium
Description
Upon gaining access to a Cisco ACI, an attacker will often first attempt to create a persistent method of reestablishing access. One way to accomplish this is to create a new account. Notification of account creation helps to mitigate this risk. Auditing account creation provides the necessary reconciliation that account management procedures are being followed. Without this audit trail, personnel without the proper authorization may gain access to critical network nodes. System messages are created by various sources, such as the Application Policy Infrastructure Controller (APIC) or the spine and leaf switches in the ACI fabric. System messages from the switches can be generated by either of the following processes: the underlying NX-OS operating system of the spine and leaf switches or the ACI-related processes in the switch. This requirement sets the default logging level on the ACI to 7. This information severity level captures normal but significant condition messages and is the level required. Satisfies: SRG-APP-000026-NDM-000208, SRG-APP-000027-NDM-000209, SRG-APP-000028-NDM-000210, SRG-APP-000029-NDM-000211, SRG-APP-000343-NDM-00028, SRG-APP-000091-NDM-000223, SRG-APP-000091-NDM-000223, SRG-APP-000495-NDM-000318, SRG-APP-000499-NDM-000319, SRG-APP-000503-NDM-000320, SRG-APP-000503-NDM-000320, SRG-APP-000504-NDM-000321, SRG-APP-000101-NDM-000231, SRG-APP-000095-NDM-000225, SRG-APP-000096-NDM-000226, SRG-APP-000097-NDM-000227, SRG-APP-000098-NDM-000228, SRG-APP-000099-NDM-000229, SRG-APP-000100-NDM-000230
STIGDate
Cisco ACI NDM Security Technical Implementation Guide2025-12-11

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-15.4Automated Audit Actions
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (49) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-16Security and Privacy Attributes
1.00
AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(3)Mandatory Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+39 more (top 10 by confidence shown)

CCI1 mapping
CCI-000018
1.00

Details

Check Text (C-271939r1114173_chk)

View the AAA event types in the local log: 1. In the menu bar, click "Admin". 2. In the submenu bar, click "AAA". 3. In the Navigation pane, choose "AAA Authentication". 4. In the Work pane, click the "History" tab. 5. Under the History tab, click the "Events" subtab to view the event log. 6. Under the History tab, click the "Audit Log" subtab to view the audit log. 7. Double-click a log entry to view additional details about the event. If account change actions are not being logged, this is a finding.

Fix Text (F-75896r1063994_fix)

To change the logging level to 6: 1. Select a service from the "Services" field in the "Changing Logging Level" window. 2. Choose the new logging level for the service from the "Logging Level" field. 3. Click "Apply".